Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/08/2026, 05:59
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe
- Size 16.9MB
- Sample260824-gp4wrstbpb
- SHA256 6ea875f97a1d721d2e15e77d2d68e41e90f011fd95e4845e80fd0c94d82cceb5
- MD5 8ddcf3ac10fff0dc3c1c93c6d06e7edc
- SHA1 73fde3a8a51f065d4ceee148282921b68d098573
- SHA512 cfc55f809d790b25bc9401f85b97411b01c15e0bae76ca7c51c65d49c0ec5dc2a547a71c70a9794a303581d3644858bd58394285743da3c8483450406a2831ea
- SSDEEP 393216:v/HNR6RyRyRXRWRXR/R/R/RXRyR/RXRRRORORc:3P
- TLSH T12107BF32B7E84AAAC2BFD375D06246212EF1B4276327EB4F5E8444FA1D13BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
resource yara_rule behavioral2/files/0x000200000001b2fd-4.dat INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL012.XML 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-phn.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\msadcor.dll 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Internet Explorer\ja-JP\ieinstal.exe.mui.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-ul-oob.xrm-ms 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-phn.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-ul-oob.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaTypewriterBold.ttf 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\MMSL.ICO.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\plugin2\vcruntime140_1.dll 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019MSDNR_Retail-pl.xrm-ms 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.COM.AU.XML.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\messages_fr.properties 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\fil_FEMININE.pak 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_ko.properties.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ppd.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ul-oob.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ppd.xrm-ms 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Yellow.xml.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv_NEUTER.pak 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\FAXEXT.ECF.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mce.dll 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\dt_socket.dll 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Java\jre-1.8\lib\flavormap.properties.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-filesystem-l1-1-0.dll 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-phn.xrm-ms.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-140.png 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.exe 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\en-GB_NEUTER.pak 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial1-ul-oob.xrm-ms 2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_8ddcf3ac10fff0dc3c1c93c6d06e7edc_coinminer_glassworm_poet-rat_sliver_snatch.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:3128
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 17.5MB
- SHA256 04c32b825cef4673ee6ed0b0b99007261989b46f3a4d7a60e40836e46b48c395
- MD5 2339e41e03a39392231000120b9f7b36
- SHA1 6994dc9e7c475cbfc226df8dc7127a20f45372df
- SHA512 e3865c24efb49f3b549641c02fabc2b54f810b95f98a72e9b88458210a2176d0093357a0a71903f4b1d3afa0254ec2a46bd7466ac45266fae40e11cacf3015b6
- SSDEEP 393216:v/HNR6RyRyRXRWRXR/R/R/RXRyR/RXRRROROR/Rc:37
- TLSH T1E407CF32B7E84AAAC2BFD375D06246222EF1B4276327EB4F5D8444FA1D13BD09915363
- MD5 SHA1 SHA512 SSDEEP TLSH